# Redpanda: CVE-2026-111943 (emudhra) Response

- Impact (vendor’s label): none
- Status: resolved · edited after publishing
- Started: 2026-10-22 17:38 UTC · Resolved: 2026-10-23 01:29 UTC · Duration: 7.8 h
- Updates: 3
- [Vendor status page: https://status.redpanda.com/incidents/01M5JB3FV469H72YGGCXXJV963](https://status.redpanda.com/incidents/01M5JB3FV469H72YGGCXXJV963)
- [Company: Redpanda](https://rewindex.com/company/redpanda.md)

## Timeline of updates

- **identified** 2026-10-22 17:38 UTC _(edited after publishing)_: We are responding internally to CVE-2026-111943 related to compromised root certificates. We have assessed Redpanda Cloud and have remediated any clusters secured with mTLS and have mitigated any other potential impacted vectors. We have also patched all Golang runtimes. We have concluded that Redpanda Brokers are not impacted in Redpanda Cloud (BYOC, Dedicated, Serverless). For Cloud and Self Hosted customers, you should review your client CAs for clients connecting outside of Redpanda, and mitigate as needed. For self-hosted clusters, particularly those with mTLS, Redpanda recommends updating truststores at the earliest opportunity.
- **identified** 2026-10-22 20:44 UTC: We have concluded that Redpanda Brokers are not impacted in Redpanda Cloud (BYOC, Dedicated, Serverless). For Cloud and Self Hosted customers, you should review your client CAs for clients connecting outside of Redpanda, and mitigate as needed. For self-hosted clusters, particularly those with mTLS, Redpanda recommends updating truststores at the earliest opportunity.
- **resolved** 2026-10-23 01:29 UTC _(edited after publishing)_: Redpanda has reviewed and confirmed that Redpanda Cloud and its associated applications are not at risk of CVE-2026-111943: https://nvd.nist.gov/vuln/detail/cve-2026-111943. Self-Hosted Customers will receive a separate Technical Services Bulletin describing actions they can take to review their Self-Hosted clusters. https://knowledgebase.redpanda.com/articles/1660912335-tsb-2026-44-self-hosted-emudhra-cve-2026-111943-response: https://knowledgebase.redpanda.com/articles/1660912335-tsb-2026-44-self-hosted-emudhra-cve-2026-111943-response?preview=true

## Rewindex changes for this incident

- 2026-10-22 20:43 UTC: [Incident silently edited: CVE-2026-111943 (emudhra) Response](https://rewindex.com/change/ra0e51e8f868bb6.md)
- 2026-10-22 20:53 UTC: [Incident updated: CVE-2026-111943 (emudhra) Response](https://rewindex.com/change/rc0703598ef337d.md)
- 2026-10-23 01:33 UTC: [Incident updated: CVE-2026-111943 (emudhra) Response](https://rewindex.com/change/r081073b19a3689.md)
- 2026-10-23 16:33 UTC: [Incident silently edited: CVE-2026-111943 (emudhra) Response](https://rewindex.com/change/r8ca27ae96b2d65.md)


---
Canonical: https://rewindex.com/company/redpanda/incidents/01M5JB3FV469H72YGGCXXJV963 · Markdown: https://rewindex.com/company/redpanda/incidents/01M5JB3FV469H72YGGCXXJV963.md · JSON: https://rewindex.com/api/v1/companies/redpanda/incidents/01M5JB3FV469H72YGGCXXJV963 · Generated 2026-10-24T11:08:03.746Z